Toward a Practical Technique to Halt Multiple Virus Outbreaks on Computer Networks

Abstract

The author analyzes a technique to prevent multiple simultaneous virus epidemics on any vulnerable computer network with inhomogeneous topology. The technique immunizes a small fraction of the computers and utilizes diverse software platforms to halt the virus outbreaks. The halting technique is of practical interest since a network's detailed topology need not be known.

1. Introduction

Malicious software, or malware, on the Internet can cause serious problems, not only for services like email and the web, but for electricity, transport, finance, and healthcare services due to their increasing Internet dependence. Infectious malware like viruses and worms are especially troublesome as they often spread too fast for human-assisted detection and early removal. Because classical signature-based approaches to malware defense do not provide adequate protection [1], there is currently a need for alternative defensive approaches.

While authors [2–8] have long debated the benefits of using added software diversity to halt malware, few results [9] actually show when diversity increases a network’s robustness to malware epidemics. We demonstrate that reasonable software diversity prevents malware from controlling much of the information on a network but only when the network’s topology is homogeneous. If a diverse network is inhomogeneous, then malware on the hubs, that is, the nodes with the most connections, can still control much of the information. We show how node immunization and software diversity together can halt infectious malware on inhomogeneous networks.

In this paper, the term “virus” denotes any form of infectious malware, and we consider the Internet as a collection of networks infected by many different viruses [10]. The viruses are allowed to reinfect machines because it is important to halt viruses that adapt over time. In the future, adaptive viruses could, with help from their creators, exploit new vulnerabilities and thus reinfect machines even after software patches have been installed.

Viruses spread by exploiting vulnerabilities in the operating system and application layers of a network. We build a model simulating multiple simultaneous outbreaks on a single layer. The network of attacked machines is modeled by a graph with different node types representing the software diversity. Since the spreading patterns of viruses vary with the considered layer and the exploited vulnerabilities [11], we model different network topologies to show that the proposed technique can halt viruses with different inhomogeneous spreading patterns.

Using the framework of network science [12], other authors have studied how to halt viruses on network monocultures with a single-software platform [13–18]. We first analyze a technique to halt multiple simultaneous virus outbreaks on inhomogeneous networks with diverse software platforms and known hubs. The halting technique is then extended to diverse inhomogeneous networks with unknown hubs [15]. The technique immunizes a small percentage of all nodes and introduces a reasonable amount of platform diversity [19, 20] to prevent the viruses from spreading. When the halting technique is applied to inhomogeneous networks, later virus outbreaks are quickly eliminated.

2. Characterizing Diversity

Two computing platforms on a network are distinct when they have no exploitable vulnerability in common. A collection of platforms can be divided into classes of mutually distinct platforms, that is, no two platforms from different classes have a common vulnerability. Here, we only consider the platforms’ OSes and web browsers. The OSes and browsers are assumed downloaded from application stores utilizing compilers with “diversity engines” to generate different binary images [19]. Assuming that the compilers generate roughly equally large classes of distinct downloadable images, the number of classes is a measure of the platforms’ software diversity.

To understand why we concentrate on the diversity of OSes and web browsers, consider the computing platforms at the hardware, network, OS, and application levels. Let the hardware diversity be the number of microprocessors with different instruction set architectures. The small number of unique microprocessors limits the hardware diversity in current and forceable systems. Further, hardware diversity is “nullified” by byte code interpreters or instruction set emulators at the OS level.

The network level’s ability to prevent virus spreading is also limited because all realizations of a communication protocol must have the same functionality. Since different OSes have similar but not equal functionalities, there is a greater potential for creating diversity at the OS level. At the application level, the diversity of web browsers is important since regular users utilize browsers most of the time. Current realizations of multibrowser technologies like Java Virtual Machines, Adobe Flash player, and JavaScript are problematic because they simplify virus attacks across different platforms.

Today, limited diversity is obtained by deploying different OSes like Windows and Mac OS X and different web browsers like Internet Explorer and Safari. Much larger diversity is possible if future application stores utilize compiler-generated diversity to make many distinct downloadable software images [19].

In the following section, we establish an epidemiological model with adjustable diversity. Since virus writes control the spreading mechanisms of viruses, we are likely to see widely different and surprising spreading patterns in the future. Thus, we do not attempt to model the details of how viruses spread. Instead the epidemiological model can incorporate any homogeneous or inhomogeneous network of vulnerable machines. In this paper, we extend well-established network models from Network Science [12] that are known to model different topological aspects of the Internet. The epidemiological model is also created to facilitate mathematical analyses.

3. Epidemiological Model

Let a computer network be infected by different viruses. The network is modeled as an undirected graph with 𝑀 edges and 𝑁 nodes of different types. The node types represent machines with distinct software on the OS or application layer and the edges represent virtual communication lines. There is at most one edge between two nodes and no edge connects nodes to themselves. If there is an edge between two nodes, then these nodes are neighbors. The degree of a node is the number of neighbors. The nodes’ average degree is ⟨𝑘⟩=(2𝑀)/𝑁.

The topology of the network depends on the considered software layer, and the vulnerabilities exploited to spread the viruses. Email viruses and viruses on the web travel over inhomogeneous networks on which a few nodes, the hubs, have very large degrees 𝑘≫⟨𝑘⟩ [11]. An inhomogeneous scale-free network is a graph whose degree distribution follows a power law, that is, the probability of a node having 𝑘 neighbors is proportional to 𝑘^−𝛾. The well-established Barabási and Albert (BA) model [21] grows a scale-free network with exponent 𝛾=3 modeling the web. The hubs are encoded by the power law’s tail. Figure 1(a) depicts a BA network with 𝑁=40 nodes and average degree ⟨𝑘⟩=2.

(a)

(b)

Figure 1 

Diverse (a) BA network and (b) WS network seeded with viruses at time step 𝑡=0. Both networks have 𝐿=3 different colored node types. Circular nodes are susceptible and star-shaped nodes are infected. There is 𝑆=1 seed for each node type. Only the 𝐿⋅𝑆=3 seeds are infected since the viruses have not started to spread. The viruses infecting the seeds control all adjacent edges (shown in red). The BA network has four isolated nodes in addition to the three infected seeds. Only the seeds are isolated in the WS network.

The Watts-Strogatz (WS) model [22] generates a homogeneous network with node degrees 𝑘≈⟨𝑘⟩ capturing the “small world” property of the Internet [12]. All nodes are placed on a circle. Initially, each node has 𝐾 neighbors in the clockwise direction and 𝐾 neighbors in the counterclockwise direction. With probability 𝑟, 0≤𝑟≤1, each of the 𝐾 clockwise edges is reconnected to a node chosen uniformly at random over the entire ring (with duplicate edges and self-loops forbidden). The WS network with 𝑁=10 and 𝐾=2 in Figure 1(b) has ⟨𝑘⟩=4 and no hubs.

All BA and WS networks, as well as other networks introduced later, have 𝐿 different node types 𝑙=1,2,…,𝐿 for 1≤𝐿≪𝑁. Each node type occurs 𝑁_𝑙 times. A node chosen uniformly at random is of type 𝑙 with probability 𝑁_𝑙/𝑁 for 𝑁=∑_𝑙𝑁_𝑙. One of the generalized entropy functions measures the diversity of a network [23]. Because we will assume that 𝑁_𝑙=𝑁/𝐿, the diversity is equal to the number of node types 𝐿 with the convention that a network with only a single type, called a monoculture, has no diversity. The networks in Figure 1 have diversity 𝐿=3.

Multiple simultaneous virus epidemics are modeled by 𝐿 susceptible-infected-susceptible (SIS) models [13, 24] operating on the same network topology but affecting 𝐿 disjoint subsets of nodes with different types. There are 𝐿 types of viruses. Each type of virus infects a particular software platform, that is, node type. Initially, all nodes are susceptible. At time step 𝑡=0, the generic model selects uniformly at random 𝑆 (≥1) nodes of each type 𝑙 and infects the nodes. These 𝐿⋅𝑆 initially infected nodes are called seeds. The stars in Figure 1 represent the seeds. For each time step 𝑡=1,2,3,…, any infected node of type 𝑙 infects any susceptible neighbor of type 𝑙 with infection probability 𝑝_𝑙, 0<𝑝_𝑙≤1. At the same time, any infected node of type 𝑙 recovers with recovery probability 𝑞_𝑙, 0≤𝑞_𝑙≤1.

When 𝑞_𝑙>0 for some 𝑙, a node can repeat the SIS life cycle many times. The result is a stochastic model with long-term dynamics, where it is assumed that the infections and recoveries are updated in a random asynchronous order. When 𝑝_𝑙=1 and 𝑞_𝑙=0 for all 𝑙, the 𝐿 SIS models become 𝐿 susceptible-infected models. The generic model is deterministic in this case since a virus infects all reachable nodes with 100% probability. Consequently, the spreading process is completely determined by the network’s topology and configuration of node types. Because no node recovers from an infection, there are no long-term dynamics. The spreading simply stops when all reachable nodes are infected.

4. Impact of Virus Outbreaks

To measure the impact of viruses on a network, one possibility is to count the infected machines. Another possibility is to consider the availability of the information on all virtual communication lines. While an infected machine should continue to operate nearly as normal to forestall virus detection, a virus can still stop selected information on the machine’s communication lines. A node in the generic model whose adjacent edges are all controlled by viruses is said to be isolated because the availability of any incoming and outgoing information cannot be guaranteed. The seven nodes with only red edges in Figure 1(a) are isolated. Note that a node is isolated when it is infected or when all its neighbors are infected.

A susceptible node always becomes isolated when it is infected since the virus on the node itself controls all adjacent edges. When an infected node recovers because the virus is removed, only the adjacent edges connecting to infected neighbors remain under control of viruses. Hence, a susceptible (i.e., not infected) node can only be isolated if all its neighbors are infected. It can be argued that we should also count a healthy node when a few but not all of its neighbors are infected. The author has ignored these partially isolated nodes to simplify the mathematical analysis in Appendix A.

Consider the deterministic model with 𝑝_𝑙=1 and 𝑞_𝑙=0 for all 𝑙. If the network is a monoculture with 𝐿=1 node type, then a susceptible node with an infected neighbor will also become infected. Hence, the number of isolated nodes equals the number of infected nodes. When an inhomogeneous network has 𝐿>1 node types, the number of isolated nodes is in general larger than the number of infected nodes. Consider a node of type 𝑙 with a few neighbors of types 𝑙^′≠𝑙. Even if the node itself is not infected, it is easily isolated by viruses on the few neighbors. These viruses control all edges connecting to the susceptible node. (Only 3 of the 7 isolated nodes in Figure 1(a) are infected.) Since the number of infected nodes can seriously underrepresent the ability of multiple virus outbreaks to control the availability of information on a diverse inhomogeneous network, we count the number of isolated nodes. Gorman et al. [10] were possibly the first to use this measurement.

4.1. Average Node Isolation

The generic model was implemented in NetLogo [25]. Initially, we utilize the deterministic model to compare the average fractions of isolated nodes on inhomogeneous networks with hubs and homogeneous networks without hubs. It is reasonable to set the recovery probabilities to 𝑞_𝑙=0 because many viruses, especially self-propagating worms, spread too fast for human-assisted detection and early removal. The infection probabilities are set to 𝑝_𝑙=1 to quickly determine the maximum possible number of isolated nodes. To explore the full effect of varying the diversity 𝐿, we assume (nearly) equally many nodes per type.

First, we evaluate inhomogeneous BA networks with 10⁴ nodes and average degree ⟨𝑘⟩=2. Figure 2(a) plots the average fraction of isolated nodes for an increasing number of node types 𝐿=2,3,…,7 and an increasing number of seeds 𝑆=1,3,5, and 10 per node type. Every discrete data point is averaged over hundred random configurations of node types and seeds for each of hundred random BA networks. BA monocultures with 𝐿=1 have an average fraction of isolated nodes equal to one (not shown in Figure 2(a)) because they are connected graphs. Going to 𝐿=2, the average fraction of isolated nodes decreases with roughly 85% or more depending on the number of seeds 𝑆 per node type. For 𝐿=7, the average fraction reduces to no more than 3% for 𝑆≤10.

(a)

(b)

(c)

(d)

Figure 2 

Average fraction of isolated nodes in (a) random BA networks with ⟨𝑘⟩=2; (b) random WS networks with ⟨𝑘⟩=6 and rewiring probability 𝑟=4%; (c) single DH network with ⟨𝑘⟩=4.12. (d) Difference between average fractions of isolated and infected nodes for 𝑆=10 in the DH network.

Second, we consider homogeneous WS networks with 10⁴ nodes, average degree ⟨𝑘⟩=6, and rewiring probability 𝑟=4%. Figure 2(b) shows the average fraction of isolated nodes for an increasing number of node types 𝐿 and an increasing number of seeds 𝑆 per node type. Each data point is generated as before. For 𝐿≥3 and 𝑆≤10, the average fraction of isolated nodes is less than 3%. While the WS networks have a larger average degree than the BA networks, the BA networks still need larger diversity 𝐿 to reduce the average fraction of isolated nodes to 3%.

Finally, we consider an inhomogeneous network with more dominant hubs than the considered BA networks. The dominant hub (DH) network represents a possible inhomogeneous spreading pattern for an outbreak of multiple viruses. The DH network has 10670 nodes and 22002 edges. The largest hub has degree 2312, which is nearly 11% of the total number of edges. Figure 2(c) depicts the average fraction of isolated nodes in the DH network for 𝐿=4,8,…,40. Each data point is averaged over 10³ random configurations. The fraction of isolated nodes reduces much more slowly and levels off at a higher value than for the other networks. For 𝐿=40, the average fraction is about 23% for 𝑆=10 and 3% for 𝑆=1.

Inspections reveal that the big hubs in the DH network isolate a large number of low-degree nodes, many of which are not infected. Figure 2(d) plots the DH network’s differences between the average fraction of isolated nodes and the average fraction of infected nodes for 𝑆=10. The DH network has a large difference for all 𝐿=1,2,…,7, roughly 40% for 𝐿=4. The simulation results in Figure 2 and the analysis in Appendix A show that the difference for random BA networks is much smaller, and the difference for random WS networks is essentially zero because they have no hubs.

According to the plots in Figure 2, the average fraction of isolated nodes in both homogeneous and inhomogeneous networks drops when the diversity 𝐿 increases. However, a significant fraction remains even for large 𝐿 when a network contains big hubs. Further, the remaining fraction of isolated nodes grows with increasing number of seeds 𝑆 per node type (see Figure 2(c)). These observations were confirmed by simulations based on eight more DH networks and many additional BA and WS networks.

4.2. Influence of Reinfected Hubs

We now study the stochastic model to determine the hubs’ influence on the fraction of isolated nodes in diverse inhomogeneous networks with reinfections of nodes.

When there are 𝑁_𝑙=𝑁/𝐿 nodes per type, an arbitrary node is a seed with probability 𝑆/𝑁_𝑙=(𝑆𝐿)/𝑁, where 𝑆 is the number of seeds per node type. Since a node of degree 𝐷 has roughly 𝐷⋅𝑁_𝑙/𝑁=𝐷/𝐿 neighbors of the same type, a node’s number of neighboring seeds of the same type is estimated by (𝑆𝐿)𝑁⋅𝐷𝐿=(𝑆𝐷)𝑁. (1)

The right-hand side of (1) is independent of the number of node types 𝐿. The number of seeds 𝑆 per node type can be large in practice because botnets are used to seed viruses. Hence, a hub with very large degree 𝐷 is likely to be infected by a seed during the first time steps of a model run, even if the diversity 𝐿 is large.

A hub of type 𝑙 is infected with probability 𝑝_𝑙⋅(𝑆𝐷)/𝑁 during the model’s first-time step. Infection will almost surely occur when 𝑝_𝑙⋅(𝑆𝐷)/𝑁≈1. During the following time steps, the hub will infect many of its 𝐷/𝐿 neighbors with the same type, where 𝐿≪𝐷 for current networks. Even more neighbors will be isolated. In particular, all degree-one neighbors of any type 𝑙^′≠𝑙 will be isolated but not infected. When the hub recovers with probability 𝑞_𝑙 during a time step, it will be quickly reinfected by one of the 𝐷/𝐿 neighbors. Since the neighbors ensure that the hub is infected nearly all the time, a nonzero fraction of isolated nodes is maintained over time even when 𝐿 is large.

Many simulations using the stochastic model confirm the hubs’ important role in making the fraction of isolated nodes much larger than the fraction of infected nodes. As seen from Figure 3, if the largest hub on a DH or BA network is immunized, that is, made permanently resistant to virus attacks, then the instantaneous fraction of isolated nodes drops significantly. There is no easily detectable reduction in the instantaneous fraction of infected nodes, confirming that the largest hub isolates many susceptible (i.e., not infected) nodes. The large fluctuations in the instantaneous fraction of isolated nodes in Figure 3(a) is due to temporary recovery of hubs.

(a)

(b)

Figure 3 

Instantaneous fractions of isolated nodes (red line) and infected nodes (green line) in diverse (a) DH network and (b) random BA network. The vertical drop in each instantaneous fraction of isolated nodes is due to immunization of the largest hub only.

The instantaneous fraction of isolated nodes will eventually go to zero because there is a non-zero probability that all nodes become susceptible in any finite-size network. However, the nonzero averaged fraction of isolated nodes was stable for very many time steps during the simulations. Hence, when hubs are reinfected, multiple virus outbreaks cause substantial long-term node isolation even for high node diversity 𝐿.

5. Halting Technique

Our goal is to halt multiple simultaneous virus outbreaks on any inhomogeneous network without changing its topology. The halting technique should drive the fraction of isolated nodes to zero in the stochastic model. For the deterministic model with a total of 𝐿⋅𝑆 seeds, the fraction of isolated nodes should not be much larger than (𝐿𝑆)/𝑁 after the viruses have spread. Since node diversity alone only eradicates viruses on homogeneous networks, we suggest the following two-step technique.(1)Immunize enough large-degree nodes in a network to create a homogeneous subnet when the immunized nodes and their adjacent edges are removed. (2)Ensure that the node diversity of the homogeneous subnet is large enough to halt (and possibly remove) multiple simultaneous virus outbreaks.

5.1. Deterministic Example

To illustrate the technique, we consider a second inhomogeneous DH network with 22963 nodes, maximum degree 2390, and average degree 4.22. Deterministic spreading of all infections is obtained by setting the infection probability 𝑝_𝑙=1 and recovery probability 𝑞_𝑙=0 for all 𝑙. The model first runs without applying the halting technique.

Figure 4(a) depicts the DH network without edges before the viruses start to spread. The four node types have different colors. The 164 largest hubs have bigger size and are placed on top of the other nodes. Twenty seeds of each type are colored red to signify infections (only a few are visible).

(a)

(b)

(c)

(d)

Figure 4 

(a) DH network with four-colored node types, 164 enlarged hubs, and twenty seeds per type. (b) After the viruses have spread, all infected nodes are red and all susceptible isolated nodes are white. (c) Same DH network, but now with dark-pink-immunized hubs and six-colored node types. (d) Since the viruses are nearly unable to spread-there are only few red-and white-isolated nodes (other nodes not shown).

The seeds infect the hubs during the first few time steps of the model run. The hubs again isolate very many low-degree nodes. When the run terminates, as shown in Figure 4(b), all infected nodes are colored red, and all susceptible nodes with only infected neighbors are colored white. The red and white nodes together constitute 18314 isolated nodes, that is, no less than 80% of all nodes.

Figure 4(c) shows the same DH network, but now with immunized, dark-pink-colored hubs. Further, the number of node types is increased from four to six. Figure 4(d) highlights the isolated nodes after the viruses have spread. The 6⋅20=120 seeds only generated 283 isolated nodes or 1% of all nodes.

5.2. Stochastic Model Analysis

While our goal is to prevent future virus epidemics, we continue to study the case where 𝐿 simultaneous virus outbreaks have already spread over the stochastic model. The halting technique’s first objective is then to immunize enough of the largest-degree nodes to obtain a homogeneous subnet of susceptible and infected nodes. To determine how many of the nodes to immunize, consider the two statements 𝒜: “network is homogeneous” and ℬ: “fractions of isolated and infected nodes are equal.” We argue that 𝒜 and ℬ are equivalent statements.

Let 𝑝_𝑙=𝑝>0 and 𝑞_𝑙=𝑞>0 for all 𝑙. Appendix A shows that when a homogeneous network is modeled as a random Erdös and Rényi graph [12], the fractions of isolated and infected nodes are essentially equal, that is, 𝒜 implies ℬ in this case. The same implication holds for generalized random networks with arbitrary “thin-tail” degree distribution. More generally, let ℎ denote the fraction of infected nodes. The likelihood that an arbitrary node is isolated but not infected on a homogeneous network is approximated by (1−ℎ)ℎ^⟨𝑘⟩, which goes to zero as the average degree ⟨𝑘⟩ increases.

To show that ℬ implies 𝒜, is equivalent to show ¬𝒜 implies ¬ℬ where ¬ denotes negation. From Appendix A, when an inhomogeneous network is represented by the BA model, the fraction of isolated nodes is larger than the fraction of infected nodes. The same is true for other network models with scale-free degree distributions. In general, there is a large fraction of nodes with few neighbors in inhomogeneous networks. While many of these low-degree nodes, for example, 𝑘∈{1,2}, are not susceptible to locally propagating viruses due to their node types, the nodes can easily be isolated by infected neighbors.

Consequently, enough large-degree nodes should be immunized to make the fractions of isolated and infected nodes nearly equal because, at least according to the provided evidence, only then do we obtain a homogeneous subnet of susceptible and infected nodes.

The halting technique’s second objective is to ensure that the number of node types 𝐿 is large enough for the remaining viruses to die out on the homogeneous subnet. Let the subnet be modeled as a generalized random network with equally many nodes of each type. According to Appendix B, the needed number of node types is then lower bounded by 𝐿>𝑧^∗⋅max_𝑙𝑝_𝑙𝑞_𝑙, (2) where 𝑧^∗ is the average degree of the subnet. From (2), the largest of the spreading rates 𝑝_𝑙/𝑞_𝑙 essentially determines the required node diversity 𝐿. Analysis in Appendix B shows that all the infected nodes recover more quickly as 𝐿 is increased beyond the lower bound in (2).

5.3. Stochastic Example

We revisit the second-discussed DH network. Assuming infection probability 𝑝_𝑙=0.06 and recovery probability 𝑞_𝑙=0.04 for all 𝑙, we select 𝐿=7 node types. The instantaneous fractions of isolated and infected nodes are shown in Figure 5(a). There is a large difference between the fractions until time step one thousand when the 216 largest hubs are immunized. The two fractions then quickly become nearly equal. All remaining infected nodes recover after an additional 2958 steps (not shown).

(a)

(b)

Figure 5 

Fractions of isolated and infected nodes caused by multiple simultaneous virus outbreaks on DH network. (a) The largest 216 hubs are immunized at time step one thousand. (b) The hubs have been correctly identified and immunized before the virus outbreaks.

A real network spanned by viruses is most often embedded in a larger network. If the larger network has adequate diversity 𝐿, then future virus outbreaks can be halted by immunizing most of the hubs visited by the viruses before the actual outbreaks. Figure 5(b) shows the fractions of isolated and infected nodes for the DH network when the 216 largest hubs have been correctly identified and immunized in advance. There is very little spreading of the viruses and all infected nodes recover after only 184 steps.

6. Generalized Halting

While we do not know the degrees of many nodes in real inhomogeneous networks [14], it is still possible to immunize hubs in advance of virus outbreaks. The acquaintance immunization strategy [15] provides an elegant solution to the problem of immunizing unknown hubs on a monoculture (𝐿=1) infected by viruses: choose a set of nodes uniformly at random and immunize one arbitrary neighbor per node. While the original set of nodes is unlikely to contain the relatively few hubs in an inhomogeneous network, the randomly selected neighbors are much more likely to be hubs, since very many edges are adjacent to high-degree nodes.

We can generalize acquaintance immunization to diverse networks. Assume 𝑁_𝑙=𝑁/𝐿 nodes per type. For some fraction 0<𝑓<1, choose a set of 𝑓⋅𝑁_𝑙 nodes of type 𝑙 uniformly at random such that each node has at least one neighbor of the same type. Immunize one randomly selected neighbor of type 𝑙 per node in the set. When the set of all immunized neighbors 𝑓𝑁=∑_𝑙𝑓𝑁_𝑙 is large enough, the set 𝑓𝑁 will contain most of the hubs and the fractions of isolated and infected nodes will be nearly equal.

6.1. Examples with Unknown Hubs

We consider the second DH network a last time, assuming unknown node degrees. Let the fraction of immunized neighbors be 𝑓=0.04(4%) and set 𝑝_𝑙=1, 𝑞_𝑙=0, and 𝐿=7. Figure 6(a) shows only the immunized dark-pink nodes and the remaining susceptible multicolored hubs after acquaintance immunization. Note that most of the 216 enlarged hubs are immunized. Figure 6(b) highlights the isolated nodes after the viruses have spread. The 7⋅20=140 seeds generated 158 isolated nodes or less than 1% of all nodes. Let 𝑝_𝑙=0.06 and 𝑞_𝑙=0.04. When acquaintance immunization is performed in advance, the fractions of isolated and infected nodes went to zero after only 154 time steps. The plot of the isolated and infected fractions (not shown) is very similar to Figure 5(b).

(a)

(b)

Figure 6 

Acquaintance immunization of DH network. (a) Immunized dark-pink nodes and remaining susceptible multicolored hubs. (b) The few red and white isolated nodes after the viruses tried to spread.

To verify the usefulness of the halting technique for inhomogeneous networks with unknown hubs, we generated additional model runs for different DH networks, including runs where the infection and recovery probabilities 𝑝_𝑙 and 𝑞_𝑙 varied with 𝑙. After first determining a suitable fraction 𝑓 of immunized nodes and number of node types 𝐿, the seeds caused little spreading and all infected nodes recovered. The speed at which the virus outbreaks die out depends on the fraction 𝑓, diversity 𝐿, selection of 𝐿⋅𝑆 seeds, and spreading rates 𝑝_𝑙/𝑞_𝑙.

7. Final Discussion

The Internet is best viewed as a large collection of networks. Because each network has different default settings, software patch levels, firewall rules, browser settings, antivirus signature sets, configuration management practices, and diagnostic capabilities, they are not all vulnerable to the same viruses [8]. However, we have seen many examples of large networks with too little software diversity to prevent virus epidemics.

Since the virus writers control the spreading mechanisms of viruses, a practical halting technique must handle viruses with widely different spreading patterns. The reported results indicate that robust halting of viruses is obtainable when application stores with “diversity engines” ensure adequate software diversity on the OS, and application layers of a network and vulnerable hubs are immunized (Appendix C discusses the halting technique’s fragility to clustering of platform types.)

The virus halting technique is of practical interest because it can handle inhomogeneous spreading patterns with unknown hubs. For a reasonable number of node types and nearly equally many nodes per type, the halting technique only needs to immunize a small percentage of all nodes to remove multiple simultaneous virus outbreaks. In contrast, acquaintance immunization of BA networks with a single-node type must immunize roughly a quarter of the nodes [15].

More work, preferably with contributions from practitioners, is needed to transform the halting technique into a practical “tool” to prevent virus epidemics. Initially, there is a need for large-scale network simulations to further verify the applicability of the technique. Mathematical analysis of additional network models would also be useful. The author believes the halting technique is particularly promising for the mobile Internet because many users already download OSes and applications to their smartphones from application stores. The technique is also likely to be suitable for the Internet of Things, where objects are periodically tethered to smartphones acting as hubs.

Appendices

A. Mathematical Analysis

The simulations discussed in Section 4.1 show that the average fractions of isolated and infected nodes differ in the BA network model but not in the WS model. Here, a mathematical analysis of four network models verifies and generalizes these observations.

In the following, an approximate mathematical analysis, based on a special case of the stochastic epidemiological model, establishes a nonzero difference between the average fractions of isolated and infected nodes in two-diverse inhomogeneous network models with scale-free “fat-tail” degree distributions. To confirm that this difference is caused by the network hubs, we initially show that essentially all isolated nodes are infected in two diverse homogeneous network models with “thin-tail” degree distributions.

All virus types in our stochastic model use the same spreading mechanism, that is, the underlying network topology is the same for all viruses, but a virus of a particular type only infects a single type of nodes. Hence, viruses of different types infect distinct subsets of nodes. Let each subset have 𝑁_𝑙=𝑁/𝐿 nodes of type 𝑙=1,2,…,𝐿, and assume that all 𝐿 subsets have infection probability 𝑝_𝑙=𝑝>0 and recovery probability 𝑞_𝑙=𝑞>0. The subsets, thus, have the same fraction of infected nodes when we average over many model runs. Further, the average fraction of infected nodes over all types, denoted ℎ_𝐿, can be obtained by considering an arbitrary subset of 𝑁/𝐿 nodes of the same type.

We consider the stochastic model after the 𝐿 simultaneous virus outbreaks, one per-node type, have reached a long-term steady state. Let a randomly chosen node have degree 𝑘 with probability 𝑝_𝑘. Ignoring short loops of connected nodes [26], the probability that a node is isolated but not infected, that is, the node itself is susceptible and all its 𝑘 neighbors are infected, is approximated by 𝑃onlyisolated≈1−ℎ_𝐿^∞_𝑘=0𝑝_𝑘ℎ_𝐿^𝑘. (A.1)

A.1. Small-World Networks

Initially, we calculate (A.1) for a slight variation on the classical WS model obtained as follows [12]. First, a regular graph is generated by placing 𝑁 nodes on a circle and then adding edges from each node to its 𝐾 nearest neighbors in the clockwise direction, 1≤𝐾≪𝑁. The resulting graph has 𝑁𝐾 edges and all nodes have degree 2𝐾.

Next, random edges or “shortcuts,” are added to the graph: We view the 𝑁 nodes as belonging to a random Erdös and Rényi (ER) graph [12] and add edges until the expected number is 𝑁𝐾𝑟 for 0<𝑟<1. The probability that there is a shortcut between two nodes is then (𝑁𝐾𝑟)/^𝑁₂, which is equal to (2𝐾𝑟)/𝑁 for large 𝑁.

The expected total degree of all nodes in the final network is 2(𝑁𝐾+𝑁𝐾𝑟)=2𝑁𝐾(1+𝑟) and the average node degree is ⟨𝑘⟩=2𝐾(1+𝑟). Since the classical WS model has ⟨𝑘⟩=2𝐾, the increase in average degree is negligible for small 𝑟.

Each node in the network has degree at least 2𝐾, due to the edges in the regular graph plus a binomially distributed number of shortcuts. Thus, a node selected uniformly at random has degree 𝑘 with probability 𝑝_𝑘=𝑁𝑘−2𝐾2𝐾𝑟𝑁^𝑘−2𝐾1−2𝐾𝑟𝑁^{𝑁−𝑘+2𝐾}, (A.2) for 𝑘≥2𝐾 [12]. Substituting (A.2) into (A.1), modifying the resulting expression, and using the Binomial Theorem, we have 𝑃onlyisolated≈1−ℎ_𝐿ℎ_𝐿^2𝐾⋅^𝑁_𝑘=0𝑁𝑘2𝐾𝑟𝑁ℎ_𝐿^𝑘1−2𝐾𝑟𝑁^𝑁−𝑘,=1−ℎ_𝐿ℎ_𝐿^2𝐾2𝐾𝑟𝑁ℎ_𝐿−1+1^𝑁. (A.3) The probability estimate in (A.3) is zero for ℎ_𝐿=0,1. For 0<ℎ_𝐿<1, the expression inside the square parentheses is less than one, and the probability goes to zero for large 𝑁, regardless the number of node types 𝐿.

A.2. Homogeneous Random Networks

We now calculate (A.1) for the homogeneous ER model [12]. The node degrees have a binomial distribution, which in the limit where the number of nodes 𝑁≫𝑘 reduces to to the Poisson distribution 𝑝_𝑘=𝑒^−𝑧𝑧^𝑘𝑘!,𝑘=0,1,…, (A.4) for 𝑧=⟨𝑘⟩ the average degree. Substituting (A.4) into (A.1) and using the definition 𝑒^𝑥=∑^∞_𝑛=0𝑥^𝑛/𝑛! give 𝑃onlyisolated≈1−ℎ_𝐿𝑒^{𝑧(1−ℎ𝐿)}. (A.5)

While a sparse ER network (𝑧≪𝑁) is very unlikely to have hubs, we have from (A.5) that the average fraction of isolated nodes is still larger than the average fraction of infected nodes for ℎ_𝐿<1. However, as we shall see, this is due to the fraction 𝑝₀=1/𝑒^𝑧 of nodes with degree zero. All these nodes without edges are isolated and cannot become infected as long as they are not seeds.

To estimate the average fraction of infected nodes ℎ_𝐿 in (A.5), we extend an analytical technique for ER monocultures (𝐿=1) introduced in [13]. Each virus outbreak in a network with 𝐿>1 node types operates on a subset of 𝑁/𝐿 nodes of the same type. On average, a node has 𝑧/𝐿 neighbors in the subset because the probability that a node is of type 𝑙 is 𝑁_𝑙/𝑁=1/𝐿. Let the spreading rate be 𝜌_𝐿=(𝑝𝑧)/(𝑞𝐿) and view ℎ_𝐿=ℎ_𝐿(𝑡) as a continuous-time variable. Writing down a differential equation representing change in the fraction of infected nodes 𝑑ℎ_𝐿𝑧𝑑𝑡=𝑝𝐿ℎ_𝐿1−ℎ_𝐿−𝑞ℎ_𝐿 (A.6) and imposing the stationary condition 𝑑ℎ_𝐿/𝑑𝑡=0, we find that the average fraction of infected nodes saturates at ℎ_𝐿=1−1/𝜌_𝐿 for 𝜌_𝐿>1. The fraction ℎ_𝐿 goes to zero in finite time when 𝜌_𝐿<1.

For fixed infection probability 𝑝, recovery probability 𝑞, and average degree 𝑧, the spreading rate 𝜌_𝐿=(𝑝𝑧)/(𝑞𝐿)<1 when the number of node types 𝐿>(𝑝𝑧)/𝑞. Consequently, ℎ_𝐿 goes to zero and (A.5) becomes equal to the fraction of nodes without edges 𝑝₀=1/𝑒^𝑧, which shrinks as 𝑧 grows.

A.3. Inhomogeneous 𝛾=3 Networks

The BA model with integer parameter 𝑚≥1 grows a scale-free network with power-law exponent 𝛾=3, average node degree ⟨𝑘⟩=2𝑚, and minimum degree 𝑚 [12]. The degree distribution is given by 𝑝_𝑘=2𝑚(𝑚+1)𝑘(𝑘+1)(𝑘+2),𝑘≥𝑚. (A.7) Using computing software (e.g., Maple or WolframAlpha) to combine (A.7) and (A.1) gives 𝑃onlyisolated≈1−ℎ_𝐿ℎ_𝐿²,ℎ_𝐿3ℎ_𝐿−2−2ℎ_𝐿−1²ln1−ℎ_𝐿,ℎ_𝐿9−2ℎ_𝐿ℎ_𝐿−6−6ℎ_𝐿−1²ln1−ℎ_𝐿, (A.8) for 𝑚=1,2, respectively.

To estimate the average fraction of infected nodes ℎ_𝐿, we extend an analytical technique for BA monocultures (𝐿=1) developed in [27]. Let ℎ_𝑘,𝐿 denote the fraction of infected nodes of degree 𝑘 in a subset of nodes with the same type. We then have ℎ_𝐿=^∞_𝑘=𝑚ℎ_𝑘,𝐿⋅𝑝_𝑘. (A.9) Since, on average, a node of degree 𝑘 has 𝑘/𝐿 neighbors of the same type, the spreading rate for nodes of degree 𝑘 is 𝜌_𝑘,𝐿=(𝑝𝑘)/(𝐿𝑞), and the overall spreading rate is 𝜌_𝐿=^∞_𝑘=𝑚𝜌_𝑘,𝐿⋅𝑝_𝑘,=𝑝𝐿𝑞^∞_𝑘=𝑚𝑘𝑝_𝑘=𝑝⟨𝑘⟩=𝐿𝑞2𝑚𝑝.𝐿𝑞 (A.10)

The change in fraction of infected nodes with degree 𝑘 is given by the differential equation 𝑑ℎ_𝑘,𝐿𝑘𝑑𝑡=𝑝𝐿1−ℎ_𝑘,𝐿Θ−𝑞ℎ_𝑘,𝐿, (A.11) where Θ denotes the probability that an edge from a node connects to an infected node of the same type. Imposing stationary, we obtain ℎ_𝑘,𝐿=𝑝𝑘Θ.𝐿𝑞+𝑝𝑘Θ (A.12) According to (A.12), the higher the degree 𝑘, the more likely a node, especially a hub, is to be infected.

The probability that an edge connects to an infected node of a particular type is given by ∑Θ=^∞𝑘=𝑚(𝑘/𝐿)𝑝_𝑘ℎ_𝑘,𝐿⟨𝑘⟩=∑/𝐿^∞𝑘=𝑚𝑘𝑝_𝑘ℎ_𝑘,𝐿.2𝑚 (A.13) If we view 𝑘 as a continuous variable, then the sum on the right-hand side of (A.13) can be estimated by an integral. Utilizing (A.12) and the estimate 𝑝_𝑘≈2 m²/k³ obtained from (A.7), we get Θ=𝑚𝑝Θ^∞_𝑚1𝑘1=𝐿𝑞+𝑝Θ𝑘𝑑𝑘𝐿𝑞𝑒𝑚𝑝^{(𝐿𝑞)/(𝑚𝑝)}−1⁻¹, (A.14) which reduces to the case studied in [27] for 𝐿=1.

Using an integral approximation one more time, we have from (A.9) and (A.12) that ℎ_𝐿=2𝑚²𝑝Θ^∞_𝑚1𝑘²1𝐿𝑞+𝑝Θ𝑘𝑑𝑘. (A.15) Finally, combining (A.14) and (A.15) gives ℎ_𝐿=2𝑒^2/𝜌𝐿−2/𝜌_𝐿−1𝑒^2/𝜌𝐿−1², (A.16) where the spreading rate 𝜌_𝐿 is defined by (A.10).

We plot the average fraction of infected nodes ℎ_𝐿 given by (A.16) as a function of the average spreading rate 𝜌_𝐿 in Figure 7(a). Unlike the ER model, there is no non-zero value of 𝜌_𝐿 for which ℎ_𝐿 drops to zero. The probability in (A.8) that a node is isolated and not infected is plotted as a function of ℎ_𝐿 in Figure 7(b). Since the probability is positive for all ℎ_𝐿>0, the hubs in the BA model (at least for 𝑚=1,2) cause the average fraction of isolated nodes to be larger than the average fraction of infected nodes for all spreading rates 𝜌_𝐿>0.

(a)

(b)

Figure 7 

Estimates for diverse BA networks with 𝑁𝑙=𝑁/𝐿, 𝑝𝑙=𝑝, and 𝑞𝑙=𝑞 for all 𝑙. (a) Average fraction of infected nodes ℎ𝐿 as a function of the average spreading rate 𝜌𝐿. (b) Probability of node being isolated and not infected as a function of ℎ𝐿.

A.4. Inhomogeneous 𝛾>2 Networks

Finally, to verify that there is no need to have power-law exponent 𝛾=3, we consider a class of inhomogeneous scale-free networks with node degrees given by the Zeta distribution 𝑝_𝑘=1𝜁𝛾𝑘^−𝛾,𝑘=1,2,…, (A.17) where 𝜁(𝛾) is the Riemann zeta function. The average degree ⟨𝑘⟩=𝜁(𝛾−1)/𝜁(𝛾) is finite for 𝛾>2. From (A.1) and (A.17), a node is isolated but not infected with probability 𝑃onlyisolated≈1−ℎ_𝐿𝜁𝛾^∞_𝑘=1ℎ_𝐿^𝑘𝑘^𝛾,=1−ℎ_𝐿𝜁𝛾𝐿𝑖_𝛾ℎ_𝐿, (A.18) where 𝐿𝑖_𝛾(⋅) denotes the polylogarithm function. The probability in (A.18) is strictly positive for any average fraction of infected nodes 0<ℎ_𝐿<1.

B. Analysis of Needed Diversity

This appendix determines a lower bound on the number of node types needed to eliminate all viruses. Since diverse scale-free networks allow viruses to spread even for very small spreading rates, hubs must be immunized to obtain a homogeneous subnet on which epidemics die out. This subnet, determined by deleting all immunized hubs and their adjacent edges in the original network, is homogeneous when the fractions of isolated and infected nodes are nearly equal. In the following, we determine a lower bound on the number of node types 𝐿 needed to remove all epidemics from the homogeneous subnet. When the subnet is not connected, we consider its giant component.

Assume roughly 𝑁_𝑙=𝑁/𝐿 nodes per type and the same infection probability 𝑝 and recovery probability 𝑞 for all epidemics. Let 𝑓 be the fraction of immunized nodes on the original network. A node selected uniformly at random in the subnet is of type 𝑙 with probability [𝑁_𝑙(1−𝑓)]/[𝑁(1−𝑓)]=1/𝐿. On average, a subnet node has 𝑧^∗/𝐿 neighbors of the same type, where 𝑧^∗ is the average node degree of the subnet. Modeling the subnet as a diverse random network and setting (A.6) equal to zero for 𝑧=𝑧^∗, we find that the epidemics die out when the diversity 𝐿>𝑝𝑧^∗𝑞 (B.1) because the spreading rate 𝜌_𝐿=(𝑝𝑧^∗)/(𝑞𝐿)<1. The lower bound in (B.1) also holds when the subnet is modeled as a generalized random network with arbitrary “thin-tail” degree distribution or a random-like small-world network with 𝑟=1 because (A.6) is valid for these networks.

As we shall see, how fast the epidemics die out is determined by the infection probability 𝑝, recovery probability 𝑞, diversity 𝐿, and average degree 𝑧^∗. For simplicity, we assume that all hub immunizations occur simultaneously and instantly. Setting 𝑧=𝑧^∗, we then solve (A.6) to determine the average fraction of infected nodes ℎ_𝐿=ℎ_𝐿(𝑡) as a function of the time 𝑡(≥0) after hubs are immunized: ℎ_𝐿(𝑡)=−ℎ₀𝑅𝑒^𝑅𝑡𝑝(𝑧^∗/𝐿)ℎ₀1−𝑒^𝑅𝑡.−𝑅 (B.2) Here, 𝑅=(𝑝𝑧^∗)/𝐿−𝑞 and ℎ₀=ℎ(0) are the fraction of infected nodes immediately after hub immunizations. For diversity 𝐿>(𝑝𝑧^∗)/𝑞, we have 𝑅<0 and ℎ_𝐿(𝑡) go to zero with increasing time 𝑡 as predicted earlier.

More importantly, the smaller infection probability 𝑝 and average degree 𝑧^∗, and the larger diversity 𝐿 and recovery probability 𝑞, the more negative 𝑅 becomes and the faster ℎ_𝐿 goes to zero. In particular, increasing 𝐿 beyond the minimum required value or immunizing more hubs to reduce 𝑧^∗ speed up virus eliminations.

We end this appendix with a generalization of the lower bound in (B.1) for varying infection probabilities 𝑝_𝑙 and recovery probabilities 𝑞_𝑙. As before, there are 𝑁/𝐿 nodes per type. Using the above technique, we can show that an epidemic on nodes of type 𝑙 dies out when 𝐿>(𝑝_𝑙𝑧^∗)/𝑞_𝑙. Let 𝑄=max_𝑙{𝑝_𝑙/𝑞_𝑙}, then all epidemics die when 𝐿>𝑧^∗⋅𝑄.

C. Fragility Analysis

The halting technique’s performance depends on the pattern of node-type assignments in a network. In general, the technique causes all epidemics to die out when the nodes of each type have a uniform distribution over the network. However, the technique fails in rare cases when most nodes of each type are clustered together.

View the homogeneous diverse subnet obtained by deleting immunized nodes and adjacent edges from the original network as 𝐿 distinct monocultures, each containing all nodes of type 𝑙. Model a monoculture as a generalized random network with arbitrary “thin-tail” degree distribution, 𝑁_𝑙 nodes, average degree 𝑧_𝑙, and spreading rate 𝜌_𝑙=(𝑝_𝑙⋅𝑧_𝑙)/𝑞_𝑙. Assume that each monoculture has a giant component, that is, a connected component with size proportional to 𝑁_𝑙. If 𝜌_𝑙>1, then a fraction ℎ_𝑙≈1−1/𝜌_𝑙 of type 𝑙 nodes will be infected [13]. The total number of infected nodes is ∑_𝑙ℎ_𝑙⋅𝑁_𝑙 when 𝜌_𝑙>1 for all 𝑙. A multi-strain global epidemic infecting nearly all nodes occurs when each ℎ_𝑙≈1.

To illustrate the longevity of a multi-strain global epidemic on the stochastic model, we consider another slight variation on the classical WS model [12]; during network construction let a node’s clockwise edges, except the edge to the nearest neighbor, be rewired with probability 𝑟=1. Then, for each node type 𝑙, assign type 𝑙 to 𝑁_𝑙=𝑁/𝐿 consecutive nodes on the circle. The result is a modified WS network with 𝐿 connected monocultures. These monocultures are giant components of size 𝑁_𝑙 allowing the seeds to infect all 𝑁 nodes.

Let 𝑝_𝑙=0.03 and 𝑞_𝑙=0.01 for all 𝑙. Figure 8 shows a snapshot of a modified WS network with 𝑁=100 nodes, 𝐿=5 colored node types, and average degree 2𝐾=6. Infected nodes are represented by stars. An edge is colored red if at least one adjacent node is infected. The fraction of isolated nodes, averaged over no less than 10⁶ time steps, is 0.9. Since the network is homogeneous, the averaged fraction of infected nodes is nearly the same. The example illustrates that homogeneous networks with large-connected subnets of the same node types are fragile to long-lasting global epidemics even for large diversity 𝐿. Such clustered patterns of node types should be avoided in real networks.

Figure 8 

Snapshot of multi-strain global epidemic on modified WS network with five node types of different colors. The stars are infected nodes and the red edges are adjacent to infected nodes.